# Vulnerabilities published in 2021


- [CVE-2021-32817](https://insights.sbomify.com/CVE-2021-32817/): File disclosure in express-hbs (medium 5.4)
- [CVE-2021-32816](https://insights.sbomify.com/CVE-2021-32816/): Regular expression Denial of Service in ProtonMail (medium 6.5)
- [CVE-2021-32815](https://insights.sbomify.com/CVE-2021-32815/): Denial of service due to assertion failure in crwimage_int.cpp (medium 5.5)
- [CVE-2021-32814](https://insights.sbomify.com/CVE-2021-32814/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Skytable (high 8.8)
- [CVE-2021-32813](https://insights.sbomify.com/CVE-2021-32813/): Drop Headers via Malicious Connection Header (medium 4.8)
- [CVE-2021-32812](https://insights.sbomify.com/CVE-2021-32812/): Cross-site scripting in monkshu (medium 4.6)
- [CVE-2021-32811](https://insights.sbomify.com/CVE-2021-32811/): Remote Code Execution via Script (Python) objects under Python 3 (high 7.5)
- [CVE-2021-32810](https://insights.sbomify.com/CVE-2021-32810/): Data race in crossbeam-deque (critical 9.8)
- [CVE-2021-3281](https://insights.sbomify.com/CVE-2021-3281/): Django Directory Traversal via archive.extract (medium 5.3)
- [CVE-2021-32809](https://insights.sbomify.com/CVE-2021-32809/): Arbitrary HTML injection vulnerability in ckeditor (medium 4.6)
- [CVE-2021-32808](https://insights.sbomify.com/CVE-2021-32808/): Cross-site scripting in ckeditor via abuse of undo functionality (high 7.6)
- [CVE-2021-32807](https://insights.sbomify.com/CVE-2021-32807/): Remote Code Execution via unsafe classes in otherwise permitted modules (medium 4.4)
- [CVE-2021-32806](https://insights.sbomify.com/CVE-2021-32806/): URL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportal (medium 6.5)
- [CVE-2021-32805](https://insights.sbomify.com/CVE-2021-32805/): URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder (high 7.2)
- [CVE-2021-32804](https://insights.sbomify.com/CVE-2021-32804/): Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization (high 8.2)
- [CVE-2021-32803](https://insights.sbomify.com/CVE-2021-32803/): Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning (high 8.2)
- [CVE-2021-32802](https://insights.sbomify.com/CVE-2021-32802/): Preview generation used third-party library not suited for user-generated content in Nextcloud server (critical 9.3)
- [CVE-2021-32801](https://insights.sbomify.com/CVE-2021-32801/): Exceptions may have logged Encryption-at-Rest key content in Nextcloud server (medium 5.5)
- [CVE-2021-32800](https://insights.sbomify.com/CVE-2021-32800/): Bypass of Two Factor Authentication in Nextcloud server (high 8.1)
- [CVE-2021-32798](https://insights.sbomify.com/CVE-2021-32798/): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook (critical 10.0)
- [CVE-2021-32797](https://insights.sbomify.com/CVE-2021-32797/): JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form> (high 7.4)
- [CVE-2021-32796](https://insights.sbomify.com/CVE-2021-32796/): Misinterpretation of malicious XML input in xmldom (medium 6.5)
- [CVE-2021-32795](https://insights.sbomify.com/CVE-2021-32795/): Denial of Service via Steam chat in ArchiSteamFarm (medium 6.5)
- [CVE-2021-32794](https://insights.sbomify.com/CVE-2021-32794/): Accidental removal of IPCPassword (< 5.1.2.4) (medium 6.8)
- [CVE-2021-32793](https://insights.sbomify.com/CVE-2021-32793/): Stored XSS Vulnerability in the Pi-hole Webinterface (medium 5.7)
- [CVE-2021-32792](https://insights.sbomify.com/CVE-2021-32792/): XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc (low 3.1)
- [CVE-2021-32791](https://insights.sbomify.com/CVE-2021-32791/): Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc (medium 5.9)
- [CVE-2021-32790](https://insights.sbomify.com/CVE-2021-32790/): Blind SQL Injection possible via Authenticated Web-hook Search API Endpoint (medium 4.9)
- [CVE-2021-3279](https://insights.sbomify.com/CVE-2021-3279/): Cross-site scripting in fortics:szchat (medium 6.1)
- [CVE-2021-32789](https://insights.sbomify.com/CVE-2021-32789/): Arbitrary SQL (SQL injection) possible via the Store API component. (high 7.5)
- [CVE-2021-32788](https://insights.sbomify.com/CVE-2021-32788/): Post creator of a whisper post can be revealed to non-staff users in Discourse (medium 4.3)
- [CVE-2021-32787](https://insights.sbomify.com/CVE-2021-32787/): Low risk information disclosure in Sourcegraph (low 3.1)
- [CVE-2021-32786](https://insights.sbomify.com/CVE-2021-32786/): Open Redirect in oidc_validate_redirect_url() (medium 4.7)
- [CVE-2021-32785](https://insights.sbomify.com/CVE-2021-32785/): Format string bug in the Redis cache implementation (medium 5.3)
- [CVE-2021-32783](https://insights.sbomify.com/CVE-2021-32783/): Authorization bypass in Contour (high 8.5)
- [CVE-2021-32782](https://insights.sbomify.com/CVE-2021-32782/): Cross-Site Scripting in Nextcloud Circles (medium 5.8)
- [CVE-2021-32781](https://insights.sbomify.com/CVE-2021-32781/): Continued processing of requests after locally generated response (high 8.6)
- [CVE-2021-32780](https://insights.sbomify.com/CVE-2021-32780/): Incorrect handling of H/2 GOAWAY followed by SETTINGS frames (high 8.6)
- [CVE-2021-3278](https://insights.sbomify.com/CVE-2021-3278/): SQL injection in local services search engine management system project:local services search engine management system (critical 9.8)
- [CVE-2021-32779](https://insights.sbomify.com/CVE-2021-32779/): Incorrectly handling of URI '#fragment' element as part of the path element (high 8.6)
- [CVE-2021-32778](https://insights.sbomify.com/CVE-2021-32778/): Excessive CPU utilization when closing HTTP/2 streams (medium 5.8)
- [CVE-2021-32777](https://insights.sbomify.com/CVE-2021-32777/): Incorrect concatenation of multiple value request headers in ext-authz extension (high 8.6)
- [CVE-2021-32776](https://insights.sbomify.com/CVE-2021-32776/): No CSRF form token cleanup on Windows servers (medium 6.8)
- [CVE-2021-32775](https://insights.sbomify.com/CVE-2021-32775/): Any user can see any fields (including mailbox password) with GroupBy Dashlet (high 7.7)
- [CVE-2021-32774](https://insights.sbomify.com/CVE-2021-32774/): Cross-Site Request Forgery (CSRF) in DataDump (medium 6.1)
- [CVE-2021-32773](https://insights.sbomify.com/CVE-2021-32773/): Confused deputy attack in sandbox module resolution (medium 6.1)
- [CVE-2021-32772](https://insights.sbomify.com/CVE-2021-32772/): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in helper_entries (high 8.8)
- [CVE-2021-32771](https://insights.sbomify.com/CVE-2021-32771/): Buffer overflow in contiki-ng (high 8.1)
- [CVE-2021-32770](https://insights.sbomify.com/CVE-2021-32770/): Basic-auth app bundle credential exposure in gatsby-source-wordpress (high 7.5)
- [CVE-2021-3277](https://insights.sbomify.com/CVE-2021-3277/): File upload in nagios:nagios xi (high 7.2)
- [CVE-2021-32769](https://insights.sbomify.com/CVE-2021-32769/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core (high 7.5)
- [CVE-2021-32768](https://insights.sbomify.com/CVE-2021-32768/): Cross-Site Scripting via Rich-Text Content (medium 6.1)
- [CVE-2021-32767](https://insights.sbomify.com/CVE-2021-32767/): Information Disclosure in User Authentication (medium 5.3)
- [CVE-2021-32766](https://insights.sbomify.com/CVE-2021-32766/): Nextcloud Text app can disclose existence of folders in "File Drop" link share (medium 5.3)
- [CVE-2021-32765](https://insights.sbomify.com/CVE-2021-32765/): Integer Overflow to Buffer Overflow in Hiredis (high 8.8)
- [CVE-2021-32764](https://insights.sbomify.com/CVE-2021-32764/): YouTube Onebox susceptible to XSS (high 8.1)
- [CVE-2021-32763](https://insights.sbomify.com/CVE-2021-32763/): Regular Expression Denial of Service in OpenProject forum messages (medium 4.3)
- [CVE-2021-32762](https://insights.sbomify.com/CVE-2021-32762/): Integer overflow that can lead to heap overflow in redis-cli, redis-sentinel on some platforms (high 7.5)
- [CVE-2021-32761](https://insights.sbomify.com/CVE-2021-32761/): Integer overflow issues with *BIT commands on 32-bit systems (high 7.5)
- [CVE-2021-32760](https://insights.sbomify.com/CVE-2021-32760/): Archive package allows chmod of file outside of unpack target directory (medium 5.0)
- [CVE-2021-32759](https://insights.sbomify.com/CVE-2021-32759/): Data Flow Sanitation Issue Fix (high 7.2)
- [CVE-2021-32758](https://insights.sbomify.com/CVE-2021-32758/): Layout XML Arbitrary Code Fix (high 7.2)
- [CVE-2021-32756](https://insights.sbomify.com/CVE-2021-32756/): Arbitrary eval through MiqExpression (high 8.8)
- [CVE-2021-32755](https://insights.sbomify.com/CVE-2021-32755/): Certificate pinning is not enforced on the web socket connection (medium 5.4)
- [CVE-2021-32754](https://insights.sbomify.com/CVE-2021-32754/): Improper Restriction of XML External Entity Reference in de.tud.sse (medium 5.3)
- [CVE-2021-32753](https://insights.sbomify.com/CVE-2021-32753/): Hardcoded credentials in edgex-go (high 8.3)
- [CVE-2021-32752](https://insights.sbomify.com/CVE-2021-32752/): Files or Directories Accessible to External Parties in ether/logs (high 7.2)
- [CVE-2021-32751](https://insights.sbomify.com/CVE-2021-32751/): Arbitrary code execution via specially crafted environment variables (high 7.5)
- [CVE-2021-32750](https://insights.sbomify.com/CVE-2021-32750/): De-anonymization via message (medium 6.8)
- [CVE-2021-3275](https://insights.sbomify.com/CVE-2021-3275/): Cross-site scripting in tp-link:archer-c3150 firmware (medium 6.1)
- [CVE-2021-32749](https://insights.sbomify.com/CVE-2021-32749/): Possible RCE vulnerability in mailing action using mailutils (mail-whois) (medium 6.1)
- [CVE-2021-32748](https://insights.sbomify.com/CVE-2021-32748/): WOPI API not protected by credentials/IP check (medium 4.3)
- [CVE-2021-32747](https://insights.sbomify.com/CVE-2021-32747/): Custom variable protection and blacklists can be circumvented (medium 5.3)
- [CVE-2021-32746](https://insights.sbomify.com/CVE-2021-32746/): Possible path traversal by use of the `doc` module (medium 5.3)
- [CVE-2021-32745](https://insights.sbomify.com/CVE-2021-32745/): Reflected Cross-Site-Scripting vulnerability (high 7.3)
- [CVE-2021-32744](https://insights.sbomify.com/CVE-2021-32744/): Unauthenticated attacker could gain access to currently open files (critical 9.8)
- [CVE-2021-32743](https://insights.sbomify.com/CVE-2021-32743/): Passwords used to access external services inadvertently exposed through API (high 8.8)
- [CVE-2021-32742](https://insights.sbomify.com/CVE-2021-32742/): Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash (high 7.5)
- [CVE-2021-32741](https://insights.sbomify.com/CVE-2021-32741/): Lack of ratelimit on public share link mount endpoint (medium 5.3)
- [CVE-2021-32740](https://insights.sbomify.com/CVE-2021-32740/): Regular Expression Denial of Service in Addressable templates (high 7.5)
- [CVE-2021-32739](https://insights.sbomify.com/CVE-2021-32739/): Privilege escalation in icinga2 (high 8.8)
- [CVE-2021-32738](https://insights.sbomify.com/CVE-2021-32738/): Utils.readChallengeTx does not verify the server account signature (medium 6.5)
- [CVE-2021-32737](https://insights.sbomify.com/CVE-2021-32737/): XSS Injection in Media Collection Title was possible (high 8.4)
- [CVE-2021-32736](https://insights.sbomify.com/CVE-2021-32736/): Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helper (high 7.5)
- [CVE-2021-32735](https://insights.sbomify.com/CVE-2021-32735/): Cross-site scripting (XSS) from field and configuration text displayed in the Panel (high 7.1)
- [CVE-2021-32734](https://insights.sbomify.com/CVE-2021-32734/): File path disclosure of shared files in Nextcloud Text application (low 3.1)
- [CVE-2021-32733](https://insights.sbomify.com/CVE-2021-32733/): XSS in Nextcloud Text application (medium 4.8)
- [CVE-2021-32732](https://insights.sbomify.com/CVE-2021-32732/): Cross-Site Request Forgery in xwiki-platform (high 7.5)
- [CVE-2021-32731](https://insights.sbomify.com/CVE-2021-32731/): The reset password form reveal users email address (medium 5.3)
- [CVE-2021-32730](https://insights.sbomify.com/CVE-2021-32730/): No CSRF protection on the password change form (medium 5.7)
- [CVE-2021-3273](https://insights.sbomify.com/CVE-2021-3273/): Code injection in nagios:nagios xi (high 7.2)
- [CVE-2021-32729](https://insights.sbomify.com/CVE-2021-32729/): A user without PR can reset user authentication failures information (low 2.0)
- [CVE-2021-32728](https://insights.sbomify.com/CVE-2021-32728/): End-to-end encryption device setup did not verify public key (medium 6.5)
- [CVE-2021-32727](https://insights.sbomify.com/CVE-2021-32727/): End-to-end encryption device setup did not verify public key (medium 5.7)
- [CVE-2021-32726](https://insights.sbomify.com/CVE-2021-32726/): Webauthn tokens not removed after user has been deleted (high 7.1)
- [CVE-2021-32725](https://insights.sbomify.com/CVE-2021-32725/): Default share permissions not respected for federated reshares (low 3.5)
- [CVE-2021-32724](https://insights.sbomify.com/CVE-2021-32724/): check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attack (critical 9.9)
- [CVE-2021-32723](https://insights.sbomify.com/CVE-2021-32723/): Regular Expression Denial of Service (ReDoS) in Prism (high 7.4)
- [CVE-2021-32722](https://insights.sbomify.com/CVE-2021-32722/): Uncontrolled Resource Consumption in GlobalNewFiles (medium 6.5)
- [CVE-2021-32721](https://insights.sbomify.com/CVE-2021-32721/): URL Redirection to Untrusted Site ('Open Redirect') in github.com/AndrewBurian/powermux (medium 4.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/154/